In a Denial-of-Service (DoS) attack, a victim network or server is flooded with a large volume of traffic, consuming critical system resources (bandwidth, CPU capacity, etc). The Internet was designed to forward packets from a sender to a client quickly and robustly. Hence, it is difficult to detect and stop malicious requests and packets once they are launched.
For example, transmission control protocol (TCP) layer software uses buffers to handle handshaking exchanges of messages used to establish a communication session. Each connection request consumes a portion of the finite memory space allotted to these buffers. A large number of connection requests received in a short period of time will consume the allotted memory space making the system unable to respond to legitimate requests and potentially causing the system to crash due to buffer overloads.
DoS attacks can particularly harm e-commerce providers by denying them the ability to serve their clients, which leads to loss of sales and advertising revenue; the patrons may also seek competing alternatives. Amazon, E*Trade, and eBay are among recent victims. Distributed DoS (DDoS) attacks can be even more damaging, as they involve creating artificial network traffic from multiple sources simultaneously. The malicious traffic may be generated simultaneously from multiple points on the network from terminals that have been “hijacked” or subverted by the attacker. A notable form of DDoS attack is access link flooding that occurs when a malicious party directs spurious packet traffic over an access link connecting an edge network of an enterprise to the public Internet. This traffic flood, when directed at a victim edge network, can inundate the access link, usurping access link bandwidth from the VPN tunnels operating over that link. As such, the attack can cause partial or total denial of the VPN service and disrupt operations of any mission-critical application that relies on that service.
There are ways to detect the source of an DoS attack, such as using statistical analysis of the source addresses of the packets. The evidence can then be used to take action against the attacker. In addition, to prevent spoofing, the IETF (Internet Engineering Task Force) has recommended ingress filtering, whereby ingress routers drop a packet that arrives on a port if the packet's source address does not match a prefix associated with the port. Ingress filtering automatically stops attacks that require spoofing, and allows the origin of the attack to be determined when the DoS does not use spoofing, simply by examining the source addresses of attack packets.
On the other hand, installation of filters to discard any traffic originating from the suspect IP addresses requires manual actions. With this semi-automated approach, the time interval between the onset of an attack and its neutralization can be in the order of minutes at best. This time interval represents a window of vulnerability for a virtual private network (VPN) operating over the attacked access link. Furthermore, when sending the packet traffic, the perpetrator may spoof a network address trusted by the enterprise, thereby making it difficult to filter the spurious traffic from the access link. To complicate the issue, although usually thought of as a malicious act, a DoS attack can sometimes happen accidentally as a result of poor planning or a sudden large increase in the traffic volume directed to a network server. Although the statistical measurements may enable one to recognize an attack, they do not provide the means to distinguish between spoofed and legitimate packets during the attack.
Policy based traffic control has become increasingly important in data communication networks as data traffic competes for limited bandwidth. Policy based traffic control generally involves separate, independent interfaces for configuring different traffic management protocols. For example, an inbound packet may be processed by a QoS (quality of service) policy engine, a NAT (network address translation) policy engine, and an ACL (access control list) policy engine. A single set of policies for controlling a plurality of different traffic management protocols may also be used. In this case a management engine configures and manages the set via a common set of commands.
The access control list (ACL policy engine is used to enforce a variety of access policies by controlling which IP packets are allowed to enter a network, based on a plurality of rules. For example, it may include rules that disallow some network users to communicate with specified users. Or, the rules may block access to a node not only based on the packet source address, but also on the destination address, protocol type, TCP port source or destination. Also, the ACL may include rules that limit access to a node to a specific data rate to avoid overwhelming the node. Vendors may also enforce various proprietary rules.
ACL rules that use rate limiting as an action may base the rate limiting on a byte based algorithm such as that described in RFC2697 and RFC2698. The approach taken in the above-identified RFCs provides a rate limiting solution based on the byte rate of the packet flow. While these RFCs just specify methods of metering the traffic, they do not specify a use for the respective methods. A general use of these methods is for example to police service level agreements (SLAs) at the edge of a network. Also, many vendors reuse these methods or other similar byte based methods to rate limit the traffic as a result of an ACL rule match.
However, since the approaches in the above-identified RFCs rate limits the packet flow based on Byte rate, these solutions are not very effective against attacks using many small packets. In addition, these solutions use multiple timestamps, state tracking, etc, making this solution very complicated to implement.
The reliability and security of an IP network is essential in a world where computer networks are a key element in intra-entity and inter-entity communications and transactions. Therefore, improve methods are required detecting and blocking DoS attacks over IP networks.